A secret-like attribute (client_secret, token, password, api_key, private_key, ...) is assigned a hard-coded string literal in Terraform.

Why this matters

The value ships in the repository and, because Terraform records arguments in state, it also lands in the state file, so it must be treated as leaked and rotated. Read it from a variable (var.*), a secret-manager data source (AWS Secrets Manager, Vault, GCP Secret Manager), or an environment-backed input instead, and keep the value out of both the code and the state where possible.

provider "okta" {
  org_name = "example"
  # ruleid: auth.iac.tf-hardcoded-oauth-secret
  api_token = "00aBcDeFgHiJkLmNoPqRsTuVwXyZ1234567890abcdef"
  # ruleid: auth.iac.tf-hardcoded-oauth-secret
  client_secret = "s3cr3t-hardcoded-oauth-client-secret-value"
}

provider "okta" {
  org_name      = "example"
  api_token     = var.okta_api_token
  client_secret = var.okta_client_secret
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.iac.tf-hardcoded-oauth-secret -- <reason>

References